Exploit for CVE-2026-78070

SQL Injection via ORDER BY Shortcode in plgcontentdpcalendar...

CVE-2026-76176 Multiple vulnerabilities in Ocsreports for OCS Inventory NG

SQL injection vulnerability in the endpoint /ocsreports/index.php?function=admindouble due to improper processing of the values in the ID field included in the selectedgrpdupli parameter. An authenticated user with operator privileges can manipulate these values to alter the SQL queries executed ...

EUVD-2026-70371

SQL injection vulnerability in the endpoint /ocsreports/index.php?function=admindouble due to improper processing of the values in the ID field included in the selectedgrpdupli parameter. An authenticated user with operator privileges can manipulate these values to alter the SQL queries executed ...

CVE-2026-76176

SQL injection vulnerability in the endpoint /ocsreports/index.php?function=admindouble due to improper processing of the values in the ID field included in the selectedgrpdupli parameter. An authenticated user with operator privileges can manipulate these values to alter the SQL queries executed ...

CVE-2026-76176 Multiple vulnerabilities in Ocsreports for OCS Inventory NG

SQL injection vulnerability in the endpoint /ocsreports/index.php?function=admindouble due to improper processing of the values in the ID field included in the selectedgrpdupli parameter. An authenticated user with operator privileges can manipulate these values to alter the SQL queries executed ...

CVE-2026-76176

CVE-2026-76176 is a SQL injection vulnerability in Ocsreports for OCS Inventory NG , located in the endpoint /ocsreports/index.php?function=admin_double. The root cause is improper processing of values in the ID field of the selected_grp_dupli[] parameter. An authenticated user with operator priv...

CVE-2026-76175

Ocsreports for OCS Inventory NG is affected by a SQL injection vulnerability in the del_check parameter of the /ocsreports/?function=save_query_list endpoint. An authenticated user with operator privileges can supply input that is incorporated into an SQL query without proper parameterisation or ...

EUVD-2026-70369

SQL injection vulnerability in the delcheck parameter of the /ocsreports/?function=savequerylist endpoint. Input provided by an authenticated user with operator privileges is incorporated into an SQL query without proper parameterisation or validation, allowing the query to be manipulated and...

CVE-2026-76175 Multiple vulnerabilities in Ocsreports for OCS Inventory NG

SQL injection vulnerability in the delcheck parameter of the /ocsreports/?function=savequerylist endpoint. Input provided by an authenticated user with operator privileges is incorporated into an SQL query without proper parameterisation or validation, allowing the query to be manipulated and...

CVE-2026-76175

SQL injection vulnerability in the delcheck parameter of the /ocsreports/?function=savequerylist endpoint. Input provided by an authenticated user with operator privileges is incorporated into an SQL query without proper parameterisation or validation, allowing the query to be manipulated and...

CVE-2026-76175 Multiple vulnerabilities in Ocsreports for OCS Inventory NG

SQL injection vulnerability in the delcheck parameter of the /ocsreports/?function=savequerylist endpoint. Input provided by an authenticated user with operator privileges is incorporated into an SQL query without proper parameterisation or validation, allowing the query to be manipulated and...

sql-injection-poc

SQL Injection PoC – gptcdharmapurico.in 🚨 LEGAL DISCLAIME...

secure-by-default-rce-demo

Node.js RCE 缓解：DevOps 作为最后一道防线 本项目演示了 Next.js 应用程序（特别是通过服务器操作）中的一个严重远程代码执行 RCE 漏洞，以及基础设施加固 如何在代码漏洞仍然存在的情况下有效阻止攻击。 它对比了使用Distroless 镜像和只读文件系统 的标准“不安全”部署与强化后的“安全”部署。 🛡️ 概念：深度防御 软件漏洞不可避免。当代码失效时，你的基础设施必须阻止攻击者扩大立足点。 漏洞 Next.js 使用的 React 服务器组件 RSC 实现中存在一个严重 RCE 漏洞（CVE-2025-55182，又名 React2Shell） 。 CVSS...

CVE-2026-3852 Divi <= 4.27.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Social Media Follow 'skype_url' Shortcode Parameter

The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the skypeurl shortcode attribute of the Social Media Follow module in all versions up to, and including, 4.27.6. This is due to a three-part sanitization failure: 1 the skypeurl field is not included in the $urloptions...

CVE-2026-3852 Divi <= 4.27.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Social Media Follow 'skype_url' Shortcode Parameter

The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the skypeurl shortcode attribute of the Social Media Follow module in all versions up to, and including, 4.27.6. This is due to a three-part sanitization failure: 1 the skypeurl field is not included in the $urloptions...

skyvern v1.0.52

🐉 Automate Browser-based workflows using LLMs and Computer Vision 🐉 Skyvern automates browser-based workflows using LLMs and computer vision. It provides a Playwright-compatible SDK that adds AI functionality on top of playwright, as well as a no-code workflow builder to help both technical and...

LinusWare-Source-Code-Internal

Linusware 1.2 — Arquitectura del Código Fuente y del Motor Reconstruido, Ingeenería Inversa y Documentado por tekkenbugatti Plataforma objetivo: Linux x8664 / Luau / Motor de ejecución de Roblox Descripción general Linusware 1.2 es una extensión de runtime nativa para Linux x8664 y un motor de...

ROPE

ROPE: Routed Origin Policy Enforcement Source code of our paper: ROPE: Routed Origin Policy Enforcement against Indirect Prompt Injection by Xinhang Ma, Chaowei Xiao, William Yeoh, Ning Zhang, Yevgeniy Vorobeychik Abstract Indirect prompt injection IPI plants instructions in the content a...

CVE-2026-54088-poc

CVE-2026-54088: 认证钩子的Shell替换导致命令注入（预认证RCE） English version 概要 此仓库是 File Browser 版本 = 2.63.5 中存在的一个严重OS命令注入漏洞 CVE-2026-54088 的 Proof of Concept PoC。 该漏洞存在于 Hook Authentication 功能中。当管理员配置 File Browser 使用外部命令进行用户认证时，登录时提交的 username 和 password 会被未经转义地通过 os.Expand 展开到已配置的命令字符串中。未认证的远程攻击者可以通过登录请求注入 She...

CVE-2026-2573

The GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) via the postBodyCss parameter in all versions up to and including 2.4.4 . The root cause is insufficient input sanitization and output escapin...